Social engineering

Phishing, pharming, shouldering and blagging, and a filter that flags them.

F11.3Cyber securityGCSE15 min

Covers OCR J277 1.4.1 Threats to computer systems and networks · AQA 8525 3.6.2 Cyber security threats · Edexcel 1CP2 5.3.1 Threats: malware and social engineering

Do this lesson in the simulator

Print it: worksheet (PDF) · answers (PDF) · as a web page

The easiest way past a lock is to get someone to open it for you. Social engineering is tricking people into giving away information or access, rather than attacking the technology. No firewall stops it, because the attacker never breaks in: they are let in. This lesson covers the common tricks and builds a filter that flags suspicious messages.

The tricks

Trick What happens
Phishing fake emails or messages, pretending to be a bank, a school or a friend, that ask you to click a link, log in, or send details
Pharming secretly sending you to a fake website even when you type the real address, to steal what you enter
Shouldering watching over someone's shoulder as they type a password or PIN
Blagging (pretexting) inventing a story to gain trust: "I'm from IT, I need your password to fix your account"
Baiting leaving an infected USB stick where someone will find it, plug it in, and be curious
Phishing uses a fake message with a link, pharming secretly redirects a real address; both end at a fake website where anything typed goes to the attackerphishingpharminga fake emailor messageyou clickits linkyou type thereal addresssecretly sentsomewhere elsea fakewebsitewhat youtype goes tothe attackerdefence: go to the websiteyourself, and the link isnever usedcaused by malware on your computer,or a tampered address lookup
Two roads to the same fake website. Going to the website yourself, in green, beats phishing, because you never use the link. Pharming is sneakier: the real address you typed is what takes you to the fake site.

Spotting a phishing message

Phishing messages usually share tells:

  • an urgent threat: "your account will be closed in 24 hours";
  • an unexpected request for a password, PIN or payment;
  • a link whose address is not the real website's;
  • poor spelling, or a greeting like "Dear Customer";
  • an address that is almost right but not quite: support@paypa1.com.

Real organisations do not ask for your password. When in doubt, do not click; go to the website yourself.

A made-up phishing email with six warning signs numbered on it and named in a keyFrom: support@paypa1.comSubject: URGENT: account closed in 24 hoursDear Customer,We have noticed a problem with your acount.Verify your password now or your accountwill be closed.Verify nowlink goes to:paypa1-secure.exampleThank you, The Security Team123456warning signs1the sender's address2an urgent threat3the greeting4poor spelling5asks for your password6where the link really goes
One made-up message with six of the warning signs on it. A real message might show only one or two, so check each thing in turn before you click anything.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

warning_signs = ["urgent", "verify your password", "click here", "you have won"]
message = "URGENT: verify your password now or your account is closed"
score = sum(1 for sign in warning_signs if sign in message.lower())
print("suspicious signs:", score)
print("phishing" if score >= 2 else "probably safe")

Run this in the simulator

Why it works

Social engineering plays on being helpful, being afraid, being curious, or being rushed. The defence is not technical: it is training, taking a moment to think, and having rules such as "IT will never ask for your password". People are the weakest link, so people are also the best defence.

Task: a phishing filter

Write score_message(message), which returns how many of the warning_signs appear in the message (ignoring capital letters). For each message in inbox, print <subject>: <score> and then, on the same line, PHISHING if the score is 2 or more. At the end print flagged <n> of <total>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

warning_signs = ["urgent", "password", "click here", "you have won", "verify", "gift card"]
inbox = [
    ("Lunch tomorrow?", "Are you free for lunch tomorrow?"),
    ("Account alert", "URGENT: verify your password by click here now"),
    ("You have won", "You have won a gift card, click here to claim"),
    ("Homework", "Here is the homework for Friday"),
]

Challenges

  1. Add a check for a web address that does not end in bugbotlab.com.
  2. Why is "Dear Customer" a warning sign, when "Dear Alex" is not?
  3. Someone rings claiming to be from IT and asks for your password. What do you do, and why?